GCP Associate Cloud Engineer Practice Question

Your team of five engineers manages several Google Cloud projects with Terraform executed from their local workstations. The Terraform state file is currently committed to Cloud Source Repositories, and concurrent terraform apply commands sometimes overwrite one another, corrupting the state. Management also wants the ability to restore any previous version of the state file without running extra servers. Which approach best meets both requirements using only Google-managed services?

Create a dedicated Cloud Storage bucket, enable Object Versioning and uniform bucket-level access, configure the Terraform gcs backend with that bucket and a prefix, and grant the team's service account the roles/storage.objectAdmin role.
Store the terraform.tfstate file in a private Artifact Registry repository and enable vulnerability scanning to detect conflicting state updates.
Move the Terraform backend to Cloud SQL, enable point-in-time recovery, and control access with Cloud IAM roles on the database.
Keep the state file in Cloud Source Repositories but enforce branch protection rules and mandatory pull-request reviews before every git push.

Report Issue

Answer Description

Storing Terraform state in a Cloud Storage (GCS) backend satisfies both needs. The GCS backend automatically uses the object's generation numbers to provide optimistic state locking, preventing simultaneous writes from different operators. By enabling Object Versioning on the bucket, every change to terraform.tfstate is preserved as a new generation, so any earlier version can be restored if corruption occurs. Granting the team's automation identity the Storage Object Admin role supplies the necessary permissions to read, write, and delete object versions.

Moving the backend to Cloud SQL would require custom scripts because Cloud SQL is not an officially supported Terraform backend. Artifact Registry does not provide state-locking features, and relying on branch protection in Cloud Source Repositories avoids direct file conflicts but offers no transactional locking or built-in versioned backups.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.